services:

  # ── MySQL Database ─────────────────────────────────────────────
  db:
    image: mysql:8.0
    container_name: megablog_db
    restart: unless-stopped
    environment:
      MYSQL_DATABASE:      megablog
      MYSQL_USER:          wpuser
      MYSQL_PASSWORD:      wppassword
      MYSQL_ROOT_PASSWORD: rootpassword
    volumes:
      - db_data:/var/lib/mysql
    networks:
      - megablog_net

  # ── WordPress ──────────────────────────────────────────────────
  wordpress:
    image: wordpress:latest
    container_name: megablog_wordpress
    restart: unless-stopped
    depends_on:
      - db
    # No public port — Nginx handles all traffic
    expose:
      - "80"
    environment:
      WORDPRESS_DB_HOST:     db:3306
      WORDPRESS_DB_USER:     wpuser
      WORDPRESS_DB_PASSWORD: wppassword
      WORDPRESS_DB_NAME:     megablog
    volumes:
      - wp_data:/var/www/html
    networks:
      - megablog_net

  # ── Nginx + SSL (Certbot / Let's Encrypt) ─────────────────────
  nginx:
    image: nginx:alpine
    container_name: megablog_nginx
    restart: unless-stopped
    depends_on:
      - wordpress
    ports:
      - "80:80"     # HTTP  → redirects to HTTPS
      - "443:443"   # HTTPS → your domain
    volumes:
      - ./nginx/default.conf:/etc/nginx/conf.d/default.conf:ro
      - certbot_www:/var/www/certbot:ro
      - certbot_certs:/etc/letsencrypt:ro
    networks:
      - megablog_net

  # ── Certbot (free SSL via Let's Encrypt) ──────────────────────
  certbot:
    image: certbot/certbot:latest
    container_name: megablog_certbot
    volumes:
      - certbot_www:/var/www/certbot
      - certbot_certs:/etc/letsencrypt
    # Run manually to issue/renew cert:
    #   docker compose run --rm certbot certonly --webroot \
    #     --webroot-path /var/www/certbot \
    #     --email you@email.com \
    #     --agree-tos --no-eff-email \
    #     -d yourdomain.com -d www.yourdomain.com
    entrypoint: ["sh", "-c", "trap exit TERM; while :; do sleep 12h; certbot renew; done"]

  # ── Ollama (self-hosted AI) ────────────────────────────────────
  ollama:
    image: ollama/ollama:latest
    container_name: megablog_ollama
    restart: unless-stopped
    # NOT exposed publicly — only reachable inside Docker network
    expose:
      - "11434"
    volumes:
      - ollama_data:/root/.ollama
    networks:
      - megablog_net
    environment:
      - OLLAMA_NUM_PARALLEL=1
      - OLLAMA_MAX_LOADED_MODELS=1
    # Uncomment for NVIDIA GPU:
    # deploy:
    #   resources:
    #     reservations:
    #       devices:
    #         - driver: nvidia
    #           count: all
    #           capabilities: [gpu]

  # ── phpMyAdmin (DB GUI — protect this in production!) ─────────
  phpmyadmin:
    image: phpmyadmin:latest
    container_name: megablog_pma
    restart: unless-stopped
    depends_on:
      - db
    expose:
      - "80"
    environment:
      PMA_HOST:     db
      PMA_USER:     wpuser
      PMA_PASSWORD: wppassword
    networks:
      - megablog_net

# ── Volumes ────────────────────────────────────────────────────
volumes:
  db_data:
  wp_data:
  ollama_data:
  certbot_www:
  certbot_certs:

# ── Network ────────────────────────────────────────────────────
networks:
  megablog_net:
    driver: bridge
